A Simple Malware Analysis Lab: The Plan Changed - Biswadeb's Lab
Biswadeb M. — Security Engineer & Independent Researcher
I set out to build something simple: a Windows VM to safely analyse malware samples, with Wireshark capturing the traffic.
That "simple" project turned into two days of network engineering.
First, VM networking wouldn't cooperate. Then I realised capturing traffic on the host would mix malware activity with normal OS noise — updates, background services, DNS, sync traffic. So I routed everything through my Kali laptop instead, which meant configuring IP forwarding and NAT just to get internet access working again.
But the real turning point was realising the whole lab was still one flat network. If a sample tried to scan, move laterally, or exfiltrate, nothing was stopping it from touching the rest of my infrastructure.
That's when the question changed from "how do I get my VM online?" to "how would this malware behave if it thought it was inside a real network?"
The answer was segmentation — isolated security domains, explicit firewall policies, and a laptop that quietly turned into a full gateway router (routing, NAT, packet forwarding, firewall enforcement, and traffic visibility) along the way.
None of this was the original plan. It emerged one solved problem at a time.
Full writeup here: https://blogs.official-biswadeb941.in/a-simple-malware-analysis-lab-the-plan-changed/
#MalwareAnalysis #CyberSecurity #NetworkSecurity #Linux #nftables
2 reactions · 0 comments
Topics: #malwareanalysis, #cybersecurity, #nftables, #linux, #networksecurity